From 730ff6f55fe4019c699e764d84913362dafc795e Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Thu, 13 Oct 2016 15:21:57 +0300 Subject: [PATCH] [SIGNED-OFF] Bug 17006: (follow-up) Let librarians change patron's passwords This should obviously be part of this feature but was left unnoticed in the first patch. If user has "borrowers"-flag, they should be able to change patron's password without providing old password. To test: 1. Run t/db_dependent/api/v1/patrons.t 2. Observe failing test 3. Apply patch 4. Run t/db_dependent/api/v1/patrons.t 5. Observe passing test 6. Send PATCH request to http://library/api/v1/patrons/YYY/password where YYY is existing borrowernumber (borrowers flag required) and where YYY is not the same borrowernumber as your logged-in user's borrowernumber 7. Make sure that password was changed for YYY. You may find this useful for testing: curl -X PATCH http://library/api/v1/patrons/123/password \ --data '{"new_password":"1234"}' \ --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10' Signed-off-by: Josef Moravec --- Koha/REST/V1/Patron.pm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Koha/REST/V1/Patron.pm b/Koha/REST/V1/Patron.pm index 2660e7f..2f5c0a9 100644 --- a/Koha/REST/V1/Patron.pm +++ b/Koha/REST/V1/Patron.pm @@ -53,21 +53,21 @@ sub changepassword { my $patron = Koha::Patrons->find($args->{borrowernumber}); my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange"); - unless ( $user - && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber}) - || haspermission($user->userid, {borrowers => 1}) ) ) - { + my $haspermission = haspermission($user->userid, {borrowers => 1}); + unless ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber} + || $haspermission) { return $c->$cb({ error => "OPAC password change is disabled" }, 403); } return $c->$cb({ error => "Patron not found." }, 404) unless $patron; my $pw = $args->{'body'}; my $dbh = C4::Context->dbh; - unless (checkpw_internal($dbh, $user->userid, $pw->{'current_password'})) { + unless ($haspermission + || checkpw_internal($dbh, $patron->userid, $pw->{'current_password'})) { return $c->$cb({ error => "Wrong current password." }, 400); } - my ($success, $errmsg) = $user->change_password_to($pw->{'new_password'}); + my ($success, $errmsg) = $patron->change_password_to($pw->{'new_password'}); if ($errmsg) { return $c->$cb({ error => $errmsg }, 400); } -- 2.1.4